Authentication - Viggle API

All V1 endpoints require a credential. Server-side SDK clients use a project API key; Remote MCP clients use an OAuth access token.

Authorization: Bearer YOUR_API_KEY

Create and revoke keys in the Viggle Dashboard. Keep keys in server-side environment variables; never expose them in browser code, mobile apps, or public repositories.

Example

curl "https://apis.viggle.ai/v1/videos/render_xxx" \
  -H "Authorization: Bearer $VIGGLE_API_KEY"

Optional request headers

Header	Description
`X-Request-Id`	Client-supplied request ID for tracing. Every response also includes an `X-Request-Id` you can capture even if you didn’t set one.
`X-Viggle-Source`	Client-supplied label identifying the calling channel or integration.

curl "https://apis.viggle.ai/v1/videos/render_xxx" \
  -H "Authorization: Bearer $VIGGLE_API_KEY" \
  -H "X-Request-Id: checkout-render-42" \
  -H "X-Viggle-Source: checkout-web"

Include the request ID when contacting support so we can trace the request.

Authentication errors

V1 errors use one envelope:

{
  "error": {
    "code": "INVALID_CREDENTIAL",
    "message": "Invalid or expired API key",
    "retryable": false,
    "request_id": "req_123abc",
    "details": {},
    "remediation": { "action": "replace_credential", "retry_after_ms": null }
  }
}

UNAUTHENTICATED means no credential was supplied at all; INVALID_CREDENTIAL means the key or token is malformed, revoked, or expired; FORBIDDEN means the credential is valid but doesn’t grant access to the requested resource. See Errors and recovery for the full code vocabulary and handling guidance.